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(54) Bus voltage detector in field device 

(57) To detect a power supply failure on an intrinsi- 
cally safe field bus of a manufacturing process control 
system in an efficient manner there is provided a field 
device with a discharge protection unit which is connect- 
ed to a control bus (10) for supply of an operating current 
from the control bus (1 0) to the field device (20, 22). The 
discharge protection unit (32) inhibits a discharge of en- 
ergy stored in the field device (20, 22) to the control bus 
(10). The field device also comprises a controller unit 



(38) adapted to control the operation of the field device 
(20, 22) and being powered with the operating current 
from the control bus (10). According to the present in- 
vention the discharge protection unit (32) comprises at 
least two rectifying elements inserted into the current 
path of the operating current with identical conducting 
directions and an input signal or an output signal of a 
selected rectifying element is supplied as interrupt sig- 
nal to the controller unit (38) for power supply failure de- 
tection. 
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Description 

FIELD OF INVENTION 

[0001] The present invention relates to a field device 
for monitoring a manufacturing process and for actuat- 
ing manufacturing process variables, and in particular 
to a field device for a monitoring a manufacturing proc- 
ess and for actuating a manufacturing process variables 
having the capability for power supply failure detection. 

BACKGROUND OF INVENTION 

[0002] Field devices as described in the following are 
generally used in manufacturing processes to monitor 
the operation and to actuate process variables within 
such a manufacturing process. Typically, a plurality of 
actuators are placed in the manufacturing field to drive 
a plurality of different process control elements, e.g., 
valves, sensors, etc. Further, transmitters are installed 
in the manufacturing field to monitor process variables, 
e.g., fluid pressure, fluid temperature or fluid flow. 
[0003] Actuators and transmitters are coupled to a 
control bus to receive and transmit process information 
to a centralized controller monitoring the overall opera- 
tion of the manufacturing process. This control bus may 
be implemented as two wire loop carrying a current that 
provides a power supply for operation of the field devic- 
es. 

[0004] In such control systems communication is typ- 
ically executed through a field bus standard which is a 
digital communication standard according to which a 
plurality of transmitters may be coupled to only a single 
control bus to transmit sensed process variables to the 
central controller. Examples for communication stand- 
ards are given in ISA 50.02-1 992 section 11 and HART® 
relying on a digital communication on the basis of a 
4-20mA processor variable signal. 
[0005] An important aspect with respect to control 
systems of the type outlined above is intrinsic safety. 
When a field device is located in a hazardous area with- 
out explosion proof equipment the electronics in the field 
device should be intrinsically safe. 
[0006] Here : intrinsic safety means that the electron- 
ics must be designed in a way that no sparks and no 
heat is generated thereby even when one or more elec- 
tronic component failures occur at the same time. 
[0007] Usually intrinsic safety is achieved through ad- 
ditional protecting elements protecting the electronics 
under a failure condition. Depending on the specific type 
of application - e.g., the explosive type of gas which is 
used within a manufacturing process - there prevail dif- 
ferent design specifications and certifications for the 
protecting elements. 

[0008] Fig. 1 shows a peripheral part of a manufac- 
turing process control system. 

[0009] As shown in Fig. 1, the peripheral part of the 
control system may comprise a first bus segment 10 of 



the intrinsic safe type and a second bus segment using, 
e.g., the RS485 standard for data communication. The 
intrinsically safe field bus segment 10 and the RS485 
bus segment 12 are coupled through a bus coupler 14. 

5 Further, the side of the intrinsically safe field bus seg- 
ment 1 0 being not attached to the bus coupler 1 4 is con- 
nected to a terminating circuit that allows to avoid re- 
flections on the intrinsically safe field bus segment 10. 
[0010] As also shown in Fig. 1 , to each bus segment 

10 10, 12 there is connected at least one field device 18, 
20, and 22. Each field device is either an actuator, a 
transmitter or another I/O device receiving/transmitting 
information. 

[0011] Further the field devices attached to the intrin- 
*5 sically safe field bus segment 10 may be powered 
through an electric current received from the intrinsically 
safe field bus segment 10 leading to a voltage drop 
across thefield devices 20, 22. Typically, the intrinsically 
safe field bus segment 1 0 will be operated under a field 
bus protocol or any other appropriate protocol allowing 
to exchange digital information. 
[001 2] As shown in Fig. 1 , operatively the field devices 
20, 22 coupled to the intrinsically safe field bus segment 
10 exchange information through modification of the 
current flowing into each field device 20, 22. For digital 
communication a basic value of the current of the intrin- 
sically safe field bus segment 1 0 is modulated to be in- 
creased or decreased by predetermined offset value, i. 
e. 9 mA for the field bus standard. This modulation of 
the current flowing into either the field device 20 or the 
field device 22 leads to a modification of the voltage U B 
on the intrinsically safe field bus segment 10 thus 
achieving digital communication. 
[0013] Fig. 2 shows a more detailed schematic circuit 
diagram of the field devices shown in Fig. 1 . 
[0014] As shown in Fig. 2, the intrinsically safe field 
bus segment 10 may be summarized into an equivalent 
circuit diagram with an ideal voltage source 24 and a 
resistor 26 to model AC voltage impedance and to fulfil 
intrinsic safety requirements for a spark protection, cur- 
rent limitation and power limitation in an hazardous ar- 
ea. 

[0015] As also shown in Fig. 2, each field device is 
connected to the intrinsically safe field bus segment 10 
with two wires 28, 30 being also connected to a dis- 
charge protection unit 32. At the output of the discharge 
protection unit 32 there is provided a modulating unit 34 
which allows to modulate the operating current flowing 
into the field device. 

[0016] The modulating unit 34 is connected in series 
to a power converter unit 36 that is adapted to map the 
operating current flowing over the modulating unit 34 in- 
to a suitable power supply signal for a control unit 38 
connected to the output of the power conversion unit 36 
and an actuator/sensor unit 40 being controlled by the 
controller unit 38. 

[0017] As also shown in Fig. 2, the controller unit 38 
is divided into a master controller and a communication 
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controller 44. While the communication controller 44 
controls the operating- current modulating unit 34 to 
achieve a modulation of the operating current and there- 
fore exchange of information between the intrinsically 
safe field bus segment 1 0 and the field device the main 5 
control of the field device is carried out by the master 
controller 42. 

[0018] Therefore, the master controller 42 not only 
controls the communication controller 44 but also either 
actuators 46, 48 or a sensor 50 in the actuator/sensor 10 
40. For each actuator 46, 48 there is provided a dedi- 
cated digital/analog converter unit 52, 54 while for the 
sensor 50 there is provided an analog/digital converter 
56. 

[0019] Further, it should be noted that while Fig. 2 « 
shows a specific number of actuators and a single sen- 
sor according to the present a number of actuators and/ 
or sensors in the actuator/sensor unit 40 is freely se- 
lectable and does not have impact on the different em- 
bodiments of the present invention to be described in 20 
the following. 

[0020] Fig. 3 shows a more detailed schematic circuit 
diagram of the power converter unit 36 shown in Fig. 2. 
[0021] As shown in Fig. 3, the power conversion unit 
36 comprises a capacitor 58 connected across the input 2s 
terminals of a DC/DC converter 60. Operatively, the ca- 
pacitor 58 achieves a stabilization of the input voltage 
Ui to the DC/DC converter 60. The output voltage Uo of 
the DC/DC converter 60 is then forwarded to the sub- 
sequent controller unit 38. ^o 
[0022] Operatively, each field device 20, 22 connect- 
ed to the intrinsically safe field bus segment 1 0 receives 
an operating current from the intrinsically safe field bus 
segment 10. When sending information from the field 
device to the intrinsically safe field bus segment 1 0 the 35 
current value for the operating current is determined 
through the modulating unit 34 under control of the com- 
munication controller 44. In other words, according to 
the control signal supplied from the communication con- 
troller 44 to the modulating unit 34 the operating current 40 
supplied to the field device and thus also the voltage of 
the intrinsically safe field bus segment 10 varies to 
achieve digital communication. 
[0023] Here : it should be noted that the particular 
communication standard used for such a communica- ^ 
tion process is not to be construed as restricting the 
present invention to be described in the following. 
[0024] Further, to receive information in the field de- 
vice the'communication controller 44 maintains the re- 
sistance value of the modulating unit 34 constant. 50 
Therefore, in case a different field device triggers a 
change of the voltage on the intrinsically safe field bus 
segment 10 the remaining field device(s) connected to 
this intrinsically safe field bus segment 10 may detect 
this change of the voltage via the connection lines 28, 55 
30 for further processing thereof in the control unit 38. 
This digital communication mechanism is used to pro- 
vide the master controller 42 in each field device with 



control information for activation of the actuators and/or 
sensors for manufacturing process control and surveil- 
lance. 

[0025] As also shown in Fig. 2, each field device 
presents an effective capacitance Ceff to the intrinsically 
safe field bus segment 1 0. 

[0026] it is for this reason that the discharge protec- 
tion unit 32 is inserted between the intrinsically safe field 
bus segment 1 0 and the field device to avoid a discharge 
of the effective capacitance Ceff onto the intrinsically 
safe field bus segment 1 0 and therefore a disturbance 
of a communication process. Another reason is to avoid 
an overall capacitance on the intrinsically safe field bus 
segment 10 that might lead to the generation of sparks 
when somewhere a short circuit occurs on the intrinsi- 
cally safe field bus segment 10. 
[0027] On the other hand, in case the voltage of the 
intrinsically safe field bus segment 1 0 breaks down and 
therefore also the power supply to each field device. 
This power supply failure is not detected immediately by 
the controller unit 38 shown in Fig. 2 due to the energy 
stored in the field device, e.g., in the capacitor 58 shown 
in Fig. 3 or other capacitive/inductive circuit components 
in the field device stabilizing internal DC voltage. 
[0028] It is for this reason that there occurs a delay 
between a decrease of the voltage on the intrinsically 
safe field bus segment 1 0 and the detection thereof at 
the controller unit 38 in case of a power supply failure. 
[0029] However, once the controller unit 38 detects 
such a power supply failure it is not possible to store 
data in internal memories of the controller unit 38 that 
may be, e.g., related to internal states of the controller 
unit or sensed process variables or stored actuator com- 
mand values since no more energy is available within 
the field device to carry out such a data saving proce- 
dure. 

[0030] In other words, since the controller unit 38 de- 
tects a power supply failure only via the signal supplied 
from the power conversion unit36-i.e., an internal com- 
ponent of the field device - this detection is delayed with 
respect to the actual power supply failure on the intrin- 
sically safe field bus segment 1 0 so that valuable time 
for the saving of internal data and actuator command 
values and sensed process variables in the controller 
unit 38 is lost. 

SUMMARY OF INVENTION 

[0031 ] I n view of th e above , a f irst 0 bject of th e p rese nt 
invention is the detection of a power supply failure on 
the intrinsically safe field bus of a manufacturing proc- 
ess control system in an efficient manner. 
[0032] A further object of the present invention is to 
provide a method for power supply failure detection in 
such a manufacturing process control system. 
[0033] ' According to the present invention, the f irst ob- 
ject is achieved by a field device for monitoring a man- 
ufacturing process and for actuating manufacturing 
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process variables according to the claim 1. 
[0034] . According to the present invention it is pro- 
posed to detect a power supply failure on the intrinsically 
safe field bus not internally within a field device but 
through detection of a signal that is in direct relationship 
to the voltage on the intrinsically safe field bus segment 
without any delay caused by energy storage.- 
[0035] In other words, the inventor of the present in- 
vention has found that it is very advantageous to use 
one of the signals at internal nodes of the discharge pro- 
tection unit of the field device that are not effected by 
the effective capacitance of the field device. 
[0036] For this reason, as soon as a power supply fail- 
ure occurs on the intrinsically safe field bus segment 
such a node signal will decline simultaneously with the 
voltage of the intrinsically safe field bus segment. It may 
therefore be used as an indication of power supply fail- 
ure. 

[0037] An important achievement of the present in- 
vention is to avoid the impact of internal energy storing 
elements - e.g., capacitors - on the power failure supply 
detection by deriving an interrupt signal for power supply 
failure indication in the first circuit stage of the field de- 
vice for direct supply to the controller unit. Therefore, 
immediately on decline of, e.g., the voltage on the intrin- 
sically safe field bus segment the controller unit be- 
comes aware of such a power supply failure. 
[0038] Since there expires a certain time interval be- 
tween breakdown of the voltage on the intrinsically safe 
field bus segment and the power supply to the controller 
unit due to the energy stored internally in the field device 
this time interval may be used to save data stored in the 
controller unit, e.g., command data for the actuators, 
measurement data from the sensors or internal states 
thereof. Therefore, a controlled restart of the field device 
after recovery of the energy supply thereto is guaran- 
teed. Also, the present invention allows to significantly 
improve the operative safety characteristic of the field 
device as any undefined controller states - e.g., false 
command values for the actuators - may be strictly 
avoided. 

[0039] Yet another important advantage of the 
present invention is - as internal states, command and 
measurement data are saved - that the field device is 
fully operative immediately after recovery of the energy 
supplied thereto, thus avoiding time consuming reset- 
ting mechanisms in the manufacturing process control 
system or - even worse - an uncontrolled operation in 
the manufacturing field. 

[0040] According to a preferred embodiment of the 
present invention the discharge protection unit compris- 
es at least two rectifying elements inserted into the cur- 
rent path of the operating current with identical conduct- 
ing directions being connected in series. Either an input 
signal or an output signal to a selected rectifying ele- 
ment may then be supplied as interrupt signal to the con- 
troller unit for a power supply failure detection. 
[0041] The use of a cascade of rectifying elements 



with an identical conducting correction enables an easy 
variation of the redundancy level in the discharge pro- 
tection unit, i.e. the degree to which a discharge of en- 
ergy from the field device onto the control bus is avoid- 

5 ed. The higher the number of the rectifier elements, the 
higher the redundancy level and degree of protection. 
[0042] According to. yet another preferred embodi- 
ment of the present invention the discharge protection 
unit comprises four rectifying elements connected in a 

10 full wave rectifier bridge network topology. Preferably, 
an additional rectifying element may be connected to a 
bridge arm node of the rectifier bridge network to in- 
crease the discharge protection redundancy level. 
[0043] The use of a bridge network topology allows to 

'5 adapt to different bus voltage polarities when connect- 
ing the field device to the intrinsically safe field bus seg- 
ment. This preferred embodiment of the present inven- 
tion is particularly useful when considering different 
communication standards that use different bus polari- 

20 ties. 

[0044] Also, in case a further rectifier element is con- 
nected to the bridge arm node of the full wave rectifier 
bridge this allows to increase the intrinsic safety as the 
additional rectifier element blocks reverse current flow 

25 and related discharge of energy from the field device to 
the intrinsically safe field bus segment. 
[0045] According to yet another preferred embodi- 
ment of the present invention an additional discharge 
protection element may be inserted into the line con- 

30 necting an interrupt signal output terminal of the dis- 
charge protection unit and the controller unit. 
[0046] Therefore, the conceptto increase the intrinsic 
safety through insertion of rectifier elements into a cur- 
rent path may as well be applied to the supply of the 

35 interrupt signal to the controller unit. In other words, the 
provision of a discharge protection element in the line 
for the supply of the interrupt signal to the controller unit 
allows to achieve the same level of intrinsic safety for 
the supply of the operating current to the field device 

40 and the supply of the interrupt signal to the controller 
unit. 

[0047] According to the present invention the second 
object outlined above is achieved through a method of 
operating a field device for monitoring a manufacturing 

45 process and for actuating manufacturing process varia- 
bles having the features of claim 12. 
[0048] Therefore, also the inventive method relies on 
the general gist of the present invention that is impera- 
tive to detect a power supply failure on the intrinsically 

50 safe field bus as soon as possible to guarantee that 
enough energy for the saving of internal states in the 
control unit of the field device is available. 
[0049] Preferably, the triggering of the interrupt at the 
controller unit and the internal saving procedure in the 

55 controller unit is achieved using predetermined thresh- 
olds that are selected such that always a safe issuance 
of the interrupt signal and a safe storage of internal 
states after a power supply failure is guaranteed. 
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[0050] According to yet another preferred embodi- 
ment of the inventive method upon receipt of the power 
supply interrupt the controller unit turns off those power 
consumers in the field device which are not necessarily 
involved into the data saving procedure, e.g., liquid crys- 
tal displays or LED diodes. 

[0051] This sophisticated power management 
achieves a longertime period for the saving of important 
data in the controller unit of the field device and thus a 
contribution to intrinsic safety of the field device. 
[0052] According to yet another preferred embodi- 
ment of the inventive method the saving of internal 
states and data is carried out according to a predeter- 
mined priority scheme. 

[0053] This embodiment of the inventive method is 
particularly useful in case data of different relevance and 
importance are stored in the memory of the controller 
unit. 

[0054] Therefore, in view of scarce energy resources 
it is very advantageous to initially safe the most impor- 
tant data and to subsequently safe data of less rele- 
vance. 

[0055] Here ; it should be noted that different priorities 
may exist for different applications and thatthe inventive 
method is thus perfectly suited to improve operable 
safety for different applications through adaptation of 
predetermined priorities for the saving of internal data/ 
states for each single application. 
[0056] According to yet another preferred embodi- 
ment of the present invention there is provided a com- 
puter program product directly loadable into the internal 
memory of a field device controller comprising software 
code portions for performing the inventive method when 
the product is run on the field device controller. 
[0057] Therefore, the present invention is also provid- 
ed to achieve an implementation of the inventive method 
steps on computer or processor systems. In conclusion, 
such implementation leads to the provision of computer 
program products for use with a computer system or 
more specifically a processor comprised in, e.g, a field 
device controller. 

[0058] This programs defining the functions of the 
present invention can be delivered to a computer/proc- 
essor in many forms, including, but not limited to infor- 
mation permanently stored on non-writable storage me- 
dia, e.g.. read only memory devices such as ROM or CD 
ROM discs readable by processors or computer I/O at- 
tachments; information stored on writable storage me- 
dia, i.e. floppy discs and harddrives; or information con- 
vey to a computer/processor through communication 
media such as network and/or telephone networks and/ 
or internet via modems or other interface devices. It 
should be understood that such media, when carrying 
processor readable instructions implementing the in- 
ventive concept represent alternate embodiments of the 
present invention. 



DESCRIPTION OF DRAWINGS 

[0059] The best mode of carrying out the invention as 
well as further advantages, objects thereof and pre- 
5 ferred embodiments will be described, in the following 
with reference to the drawing in which: 

Fig. 1 shows peripheral parts of a manufacturing 
process control system as technical back- 
to ground for the present invention; 

Fig. 2 shows a schematic circuit diagram of thefield 
device shown in Fig. 1; 

15 Fig. 3 shows a schematic diagram of the power 
converter unit shown in Fig. 2; 

Fig. 4 shows a schematic circuit diagram of a field 
device according to the present invention; 

20 

Fig. 5 shows a signal waveform diagram illustrating 
the impact of a power supply failure on the 
power supply signal to the controller in the 
field device shown in Fig. 4; 

25 

Fig. 6 shows a flowchart of the method to operate 
a field device according to the present inven- 
tion; 

30 Fig. 7 shows a discharge protection unit providing 
• an interrupt signal according to the present 
invention; 

Fig. 8 shows another discharge protection unit pro- 
35 viding an interrupt signal according to the 

present invention; 

Fig. 9 shows another discharge protecting unit pro- 
viding an interrupt signal according to the 
40 present invention; 

Fig. 10 shows another discharge protecting unit pro- 
viding an interrupt signal according to the 
present invention; and 

45 

Fig. 11 shows yet another discharge protection unit 
providing an interrupt signal according to the 
present invention. 

so BEST MODE OF CARRYING OUT THE INVENTION 

[0060] Fig. 4 shows a schematic diagram for a field 
device according to the present invention. Those parts 
being identical to those previously discussed with re- 
55 spectto Fig. 4 or corresponding thereto are denoted us- 
ing the same reference numerals and the explanation 
thereof will be omitted to avoid redundancy. 
[0061] As shown in Fig. 4, the discharge protection 



Fig. 1 

10 

Fig. 2 
15 Fig. 3 
Fig. 4 

20 

Fig. 5 

25 

Fig.6 
30 Fig. 7 
Fig. 8 

35 



45 

Fig. 11 



9 



EP 1 202139 A1 



10 



unit 32 according to the present invention is provided 
with an interrupt signal output terminal 62. As will be ex- 
plained in more detail in the following, this interrupt sig- 
nal output terminal 62 may be connected to any internal 
network node of the discharge protection unit 32, i.e. 
also to the input terminal or the output terminal of the 
discharge protection unit 32. 

[0062] As also shown in Fig. 4, there is provided a in- 
terrupt signal line 64 connecting the interrupt signal out- 
put terminal 62 with the controller unit 68 of the field de- 
vice. Preferably a discharge protecting element 66 is 
inserted into the interrupt signal supply line 64 to avoid 
reverse current flow onto the intrinsically safe field bus 
segment 10 and therefore discharge of energy. 
[0063] It is important to note that the discharge pro- 
tection unit 32 only contains rectifying elements and 
therefore no energy storing components, e.g., capaci- 
tors. Therefore, as soon as the voltage on the intrinsi- 
cally safe field bus segment 10 declines due to a power 
supply failure also the signal levels at internal nodes in 
the discharge protection unit 32 will decrease accord- 
ingly. 

[0064] Operatively, as one of the internal node signals 
is connected to the interrupt signal output terminal 62 
there is available an interrupt signal that decreases im- 
mediately when the bus voltage on the intrinsically safe 
field bus segment 10 decreases. 
[0065] I n other words, the signal at the interrupt signal 
output terminal 62 decreases instantly in case of a pow- 
ersupply failure while the output signal of the power con- 
version unit 36 supplying the controller unit 38 decreas- 
es only after a certain time period when the energy 
stored in the field device - e.g. , in the capacitor 58 shown 
in Fig. 3 - is consumed. 

[0066] It is an important aspect of the present inven- 
tion that this time period may then be used to save in- 
ternal states and/or command data and/or measure- 
ment data stored in the controller unit. One option is to 
store such data in a (not shown) non-volatile memory of 
the controller unit 38, e.g., an EEPROM memory (EEP- 
ROM = Electrically Erasible Programmable Read Only 
Memory). This will typically require some milliseconds 
of time. 

[0067] Fig. 5 shows a signal waveform diagram illus- 
trating the impact of a power supply failure on the intrin- 
sically safe field bus segment onto the supply signal of 
the controller unit in more detail. In particular, the upper 
part of Fig. 5 shows the voltage on the intrinsically safe 
field bus segment 1 0 and the lower part of Fig. 5 shows 
the supply signal Uo for the controller unit 38 of the field 
device. 

[0068] When a power supply failure occurs on the in- 
trinsically safe field bus segment 1 0 the bus voltage will 
decrease from the nominal value to approximately a val- 
ue of zero. 

[0069] To avoid that every minor decrease of the bus 
voltage is interpreted as power supply failure, preferably 
a threshold comparison between the bus voltage UB 



and a minimum bus voltage U Bmin - i.e. predetermined 
first threshold - is carried out to avoid an incorrect interr 
rupt at the controller unit. 

[0070] As shown in Fig. 5, in case the bus voltage UB 
5 becomes lower than the minimum required bus voltage 
U B min at time t1 an interrupt signal is provided via the 
interrupt signal output terminal 62 of the discharge pro- 
tection unit 32 to the controller unit 38 of the field device, 
e.g., in the form of a non-maskable interrupt. 
10 [0071] As also shown in Fig, 5, the supply signal Uo 
at the output of the power conversion unit 36 only de- 
creases after a certain period of time AT since energy 
is internally stored in the field device and may be used 
for further power supply of the controller unit also after 
15 occurrence of a power supply failure. 

[0072] Therefore, during this period of time AT the 
controller unit 38 may be further operated to run a shut- 
down procedure and save internal states and/or com- 
mand data and/or measurement data. 
20 [0073] To guarantee that such a saving procedure is 
always run under definite operative conditions, the sav- 
ing procedure should be terminated when the supply 
signal to the controller unit 38 gets lower than a mini- 
mum required supply signal U Q min at point of time t2. 
25 [0074] Here, it should be noted that according to the 
present invention the specific values of the minimum 
bus voltage U Bmin and the minimum required supply 
signal U Q mjn for the controller unit 38 are freely selecta- 
ble parameters. 
30 [0075] E.g., the higher U B mjn and the lower the value 
°f u o,mirv tne longerthetime periodAT will be, however, 
at the risk of a slightly increased chance of a wrong in- 
terrupt signal or an operation of the controller unit 38 
during the period AT with a supply signal Uo being too 
35 small. To the contrary, in case the value of U B m[n is de- 
creased and the value of U Q mjn is increased, the risk of 
a wrong interrupt is minimized and the controller unit 38 
will always carry out a stable saving procedure, howev- 
er, at the expense of a reduced time period AT. In con- 
40 clusioa there exists a certain design trade off which is 
preferably decided in view of the considered application. 
[0076] Further, while above the detection of a power 
supply failure has been discussed with respect to the 
voltage on the intrinsically safe field bus segment it 
45 should be clear that the same results may be achieved 
through detection of the operating current flowing into 
the field device, e.g., through detection of the current 
passing over the modulating unit 34. This current value 
may then be processed in an analog manner for a power 
50 failure detection. Alternatively, the signal may be sup- 
plied to a comparator (not shown) for a threshold com- 
parison to derive a digital output indicating a power fail- 
ure. 

[0077] Further, in case the field device is provided with 
55 a dedicated energy buffer for supply of energy to the 
circuit components of the field device on occurrence of 
a power failure as described in the co-pending applica- 
tion "Load Voltage Controller For A Field Device And 
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Related Control Method" assigned to the same appli- 
cant and incorporated herein in full by reference, also 
the discharge signal to such a dedicated energy buffer 
may be used for power failure detection. 
[0078] Fig. 6 shows a flowchart of the inventive meth- 
od of operating a field device in more detail. While the 
flowchart refers to the bus voltage on the intrinsically 
safe field bus, it should be noted that it should equiva- 
lents applicable to the alternatives outlined above, i.e. 
the monitoring of an operating current flowing into the 
field device or the monitoring of a supply current flowing 
out of an energy buffer provided in the field device. 
[0079] As shown in Fig. 6, the voltage on the intrinsi- 
cally safe field bus segment is detected in step S1 and 
compared with a minimum required bus voltage U B min 
in step S2. In case the bus voltage is higher than the 
minimum required value, the detection of the bus volt- 
age is continued in step S1 . 

[0080] Concurrently to the step S1 and step S2 the 
signal available at the interrupt signal output terminal 62 
of the discharge prevention unit 32 is supplied to the 
controller unit 38 of the field device. Therefore, the mas- 
ter controller 42 of the controller unit 38 may continu- 
ously scan the signal supplied via the interrupt signal 
output terminal 62 without any delay through energy 
storing circuit components of the field device, as out- 
lined above. 

[0081] As also shown in Fig. 6, subsequent to the de- 
tection of a power supply failure in step S2 it is checked 
whether the supply signal to the controller unit 32 of the 
field device is larger than the required minimum value 
U o min in step S3. If this is not the case - e.g., in the rare 
case where a power supply failure occurs immediately 
after start of operation of the field device - the process 
shown in Fig. 6 branches off to step S4 to wait for the 
restart of the energy supply to the field device. Other- 
wise, the saving of internal states and/or command data 
and/or measurement data is started in step S5. 
[0082] According to the embodiment shown in Fig. 6, 
it is assumed that the storage of internal states/data is 
segmented so that a further interrogation whether more 
internal states are to be saved may be carried out in step 
S6v In the affirmative case, it is then checked whether 
still enough energy is available for the controller unit 38 
of the field device. If no more internal states/data are/is 
to be saved or no more energy is available, the proce- 
dure branches off to step S4 to wait for restart of energy. 
Otherwise, step S5 is repeated to write further internal 
states/data into the non-volatile memory of the controller 
unit 38. 

[0083] The segmentation of the saving of internal 
states/data as shown in Fig. 6 allows for a repeated eval- 
uation of the energy available for the controller unit 38 
of the field device running the saving procedure. There- 
fore, no saving of internal states/data is carried out in 
case the energy supplied to the controller unit is not lying 
in an operative range to avoid incorrect storage of 
states/data and therefore a subsequent incorrect oper- 



ation of the field device. This allows to contribute to the 
overall safe operation of the field device. 
[0084] Still further the sequential approach to the sav- 
ing of internal states/data allows to introduce a priority 

5 scheme where more important states/data are safe be- 
fore less relevant states/data with less impact on the 
■ overall safe operation of the field device. 

[0085] Yet another embodiment of the present inven- 
tion considers the structure of the software running in 

10 the controller. Here, the software comprises a plurality 
of so-called function blocks according to a variety of pro- 
tocols. According to the present invention it is also pos- 
sible to map the interrupt signal submitted to the con- 
troller unit for a power supply failure detection into a var- 

15 jable. This variable would be one of many transmitter 
variables available to function blocks executing in the 
field device. In case this variable indicates a power sup- 
ply failure each function block could then take one last 
action before the shut down procedure and in the field 

20 device. 

[0086] Fig. 7 (a) to (c) show a discharge protection 
unit providing an interrupt signal according to the 
present invention. 

[0087] As shown in Fig. 7, the first discharge protec- 
ts tion unit uses a cascade of diodes 68, 70, ...,72 for dis- 
charge protection from the field device onto the intrinsi- 
cally safe field bus segment 1 0. 
[0088] Further, the interrupt signal may be branched 
off either from the input terminal, any intermediate node 
30 between the rectifying elements - e.g., diodes - of the 
discharge protection unit or the output terminal thereof, 
as shown in Fig. 7 (a) to (c). 

[0089] Since the discharge protection unit shown in 
Fig. 7 comprises no energy storing circuit components, 

35 the voltage signal either at the input terminal the output 
terminal or any internal node thereof will decrease con- 
currently to the bus voltage on the intrinsically safe field 
bus segment 1 0 on occurrence of a powersupply failure. 
[0090] As already outlined above, the interrupt signal 

40 output terminal 62 may be connected to a discharge pro- 
tection element having a conducting direction running 
from the discharge protection unit 32 to the controller 
unit 38 to guarantee intrinsic safety in the field device 
also when detecting the bus voltage on the intrinsically 

45 safe bus signal 10. 

[0091] Fig. 8 shows another discharge protecting unit 
providing an interrupt signal according to the present in- 
vention. 

[0092] As shown in Fig. 8, the discharge protection 
50 unit is of the full bridge rectifier type, i.e. a Graetz-diode- 
bridge, and comprises four rectifying elements 74 to 80, 
e.g., diodes. As is known in the art, the different rectify- 
ing elements are arranged in a bridge-like form (shown 
in the lower part of Fig. 8) between a node a and d con- 
55 ^ stituting the input terminals of the discharge protection 
unit 32 and further between nodes b, c constituting the 
output terminals of the discharge protection unit 32. 
Since such a circuit arrangement is commonly known in 
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the art, no further explanation thereof must be given. 
[0093] Insofar as the present invention is concerned, 
the discharge protection unit 32 is provided with an ad- 
ditional interrupt signal output terminal 62 that is con- 
nected selectively to either node a, b, c, or d. Therefore, 5 
the node signal at any node a to d may be supplied to 
the controller unit 38 as interrupt signal to trigger the 
non-maskable interrupt at the controller unit. 
[0094] Fig. 9 shows another discharge protection unit 
providing an interrupt signal according to the present in- 
vention. Those parts being identical to the circuit com- 
ponents described with respect to Fig. 8 are denoted 
using the same reference numerals and description 
thereof is omitted. 

[0095] As shown in Fig. 9, the discharge protecting 
unit shown in Fig. 8 differs over the previously described 
discharge protecting unit shown in Fig. 8 in that an ad- 
ditional rectifying element 82 - e.g., a diode - is provided 
between node b and the output terminal node e of the 
discharge protecting unit 32 with its conducting direction 
to the output node e of the discharge protecting unit 32. 
[0096] This additional rectifying element 82 allows to 
increase the intrinsic safety of the field device due to the 
additional rectifying element supporting a discharge 
protection from the field device onto the intrinsically safe 
field bus segment. According to the present invention, 
the interrupt signal output terminal 62 of the discharge 
protection unit 32 may be connected to any of the nodes 
a to e shown in Fig. 9 for a power failure detection. 
[0097] Fig. 10 shows yet another discharge protection 
unit providing an interrupt signal according to the 
present invention. Again, those circuit elements that 
have been previously described with respect to Fig. 8 
and 9 are denoted using the same reference numerals 
and description thereof is omitted. 
[0098] The discharge protection unit shown in Fig. 1 0 
differs over the previously described discharge protec- 
tion unit shown in Fig. 9 in that the additional rectifying 
element 82 is moved over node b into the branch a-b 
and d-b of the full wave rectifier bridge. The discharge 
protection unit 32 shown in Fig. 10 achieves an in- 
creased level of discharge protection through provision 
of the additional rectifying elements 82-1 , 82-2. The in- 
terrupt signal output terminal 62 may be connected to 
any node a, b, c, or d or any further internal node, e.g. 
between rectifying elements 74/82-1 and/or between 
rectifying elements 76/82-2. 

[0099] Fig. 11 shows yet another discharge protection 
unit providing an interrupt signal according to the 
present invention. Those circuit elements being identi- 
cal to the discharge protection unit discussed previously 
with respect to Fig. 10 are denoted using the same ref- 
erence numerals and description thereof is omitted. 
[01 00] The discharge protection unit 32 shown in Fig. 
11 differs over the discharge protecting unit shown in 
Fig. 10 in that a first resistor 84 and a second resistor 
'86 are connected in series between a line connecting 
the rectifier element 74 and the rectifier element 82-1 



and a line connecting the rectifying element 76 and the 
rectifying element 82-2. 

[0101] As shown in Fig. 11, a signal at the network 
node 88 between the first resistor 84 and the second 
resistor 86 is used as interrupt signal at the interrupt sig- 
nal output terminal 62. Operatively, the additional resis- 
tors 84 and 86 allow for the determination of an appro- 
priate interrupt signal level at the interrupt signal output 
terminal 62. 

[0102] While in the above the present invention has 
been described with reference to circuit diagrams of pre- 
ferred embodiments of the inventive field device, it 
should be noted that clearly the present invention may 
also be implemented using the method of operating a 
field device according to the present invention in a digital 
way using a microcontroller. In this case, the present in- 
vention may be embodied as a computer program prod- 
uct directly loadable into the internal memory of the con- 
troller unit comprising software code portions for imple- 
menting the inventive method. 

[0103] Futher, it is understood that various other mod- 
ifications will be apparent to and can be readily made 
by those skilled in the art without departing from the 
scope and spirit of the present invention. Accordingly, it 
is not intended that the scope of the claims appended 
hereto be limited to the description as set forth herein, 
but rather that the claims should be so construed as en- 
compassing all the features of patentable novelty that 
reside in the present invention, including all features that 
would be treated as equivalent thereof by those skilled 
in the art to which the present invention pertains. 

Claims 

1. Field device for monitoring a manufacturing proc- 
ess and/orfor actuating manufacturing process var- 
iables, comprising: 

a) a discharge protection unit (32) being con- 
nected to a control bus (1 0) for supply of an op- 
erating current from the control bus (1 0) to the 
field device (20, 22) such that the discharge 
protection unit (32) inhibits a discharge of en- 
ergy stored in the field device (20, 22) to the 
control bus (10); 

b) a controller unit (38) adapted to control the 
operation of the field device (20, 22) and being 
powered with the operating current from the 
control bus (10); wherein 

c) the discharge protection unit (32) comprises 
at least two rectifying elements inserted into the 
current path of the operating current with iden- 
tical conducting directions and an input signal 
or an output signal of a selected rectifying ele- 
ment is supplied as interrupt signal to the con- 
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troller unit (38) for power supply failure. detec- 
tion. 

2. Field device according to claim 1 , characterized in 
that ihe discharge protection unit (32) is provided s 
with an interrupt signal output terminal (62) being 
connected to an input or to an output of the selected 
rectifying element. 

3. Field device according to claim 1 or 2, character- 10 
izedin thatW comprises an operating current mod- 
ulating unit (34) being adapted to vary an effective 
resistance presented through the field device (20, 

22) to the control bus (10) which operating current 
modulating unit (34) is serially connected to the dis- ts 
charge protection unit (32) for information ex- 
change to/from the field device (20. 22) through op- 
erating current modulation under control of the con- 
troller unit (38). 

20 

4. Field device according to claim 3, characterized in 
that a power conversion unit (36) is connected in 
series between the operating current modulating 
unit (34) and the controller unit (38) for powersupply 

of the controller unit (38) and/or actuators (46, 48) 25 
and/or sensors (50) of the field device (20, 22). 

5. Field device according to one of the claims 1 to 4, 
characterized in thatthe discharge protection unit 
(32) comprises three rectifying elements (68, 70, 30 
72) connected in series. 

6. Field device according to one of the claims 1 to 4, 
characterized in thatthe discharge protection unit 
(32) comprises four rectifying elements (74-80) 35 
connected in a full wave rectifier bridge network to- 
pology. 

7. Field device according to claim 6, characterized in 
thatthe discharge protection unit (32) further com- 40 
prises an additional rectifying element (82) being 
connected to a bridge arm node (b) of the full wave 
rectifier bridge (74-80) at its input and to the oper- 
ating current modulation unit (34) at its output. 

45 



Field device according to one of the claims 1 to 4, 
characterized in thatthe discharge protection unit 
(32) comprises six rectifying elements connected in 
a full wave rectifier bridge network topology, where- 
in the full wave rectifier bride has a first node (a) so 
arid a second node (d) connected to the control bus 
(10) and a third node (b) connected to a down- 13. 
stream circuit component (34) of the field device 
and a fourth node (c) connected to ground, further 
wherein a first rectifying element (78) having a first 55 
conduction direction is inserted between the first 
node (a) and the third node (c), a second rectifying 
element (80) having a second conduction direction 



is inserted between the fourth node (c) and the sec- 
ond node (d), a third rectifying element (74) and a 
fourth rectifying element (82-1) having the second 
conduction direction, respectively, are inserted be- 
tween the first node (a) and the third node (b), and 
a fifth rectifying element (76) and a sixth rectifying 
element (82-2) having the first conduction direction, 
respectively, are inserted between the third node (b) 
and the second node (d). 

9. Field device according to claim 8, characterized in 
that a first resistor (84) and a second resistor (86) 
are connected in series between a line connecting 
the third rectifying element (74) and the fourth rec- 
tifying element (82-1 ) and a line connecting the fifth 
rectifying element (76) and the sixth rectifying ele- 
ment (82-2) and that the signal at the network node 
(88) between the first resistor (84) and. the second 
resistor (86) is used as interrupt signal at the inter- 
rupt signal output terminal (62). 

10. Field device according to one of the claims 1 to 9, 
characterized in that a discharge protection ele- 
ment (66) is inserted in the line (64) connecting the 
interrupt signal output terminal (62) and the control- 
ler unit (38). 

11. Field device according to one of the claims 1 to 10, 
characterized in that each rectifying element 
(72-82-2) and/or the discharge protection element 
(66) is a diode. 

12. Method of operating a field device for monitoring a 
manufacturing process and/or for actuating manu- 
facturing process variables, comprising the steps: 

a) continuously monitoring a voltage on a con- 
trol bus (1 0) connecting the field device (20,22) 
with a central controller or an operating current 
flowing from the control bus (1 02) into the field 
device (20, 22); 

b) generating of a power supply interrupt signal 
when the monitored voltage/operating current 
decreases beyond a predetermined first 
threshold (U B min ); and 

c) saving internal states in a field device con- 
troller (38) after supply of the power supply in- 
terrupt signal to the field device controller (38). 



Method according to claim 12, characterized in 
that internal states of the field device controller are 
saved until the supply signal forthe field device con- 
troller (38) decreases beyond a predetermined sec- 
ond threshold (U Q mjn ) or all internal states data are 
saved. 
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14. Method according to claim 12 or 13, characterized 
in that upon receipt of the power supply interrupt 
signal the field device controller (38) turns off power 
consumers in the field device for reduced power 
consumption. > 5 

15. Method according to one of the claims 12 to 14, 
characterized in that the saving of internal states 
is carried out according to a predetermined priority 
scheme. 10 

16. Computer program product directly loadable into 
the internal memory of a field device controller (38) 
comprising software code portions for performing 

the steps of one of the method claims 1 2 to 1 5 when 15 
the product is run on the field device controller (38). 
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FIG.3 
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FIG. 5 
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